CN103562863A

CN103562863A - Creating a correlation rule defining a relationship between event types

Info

Publication number: CN103562863A
Application number: CN201180071393.XA
Authority: CN
Inventors: J.施梅尔普丰; F.福塞勒; M.博斯勒
Original assignee: Hewlett Packard Development Co LP
Current assignee: Hewlett Packard Development Co LP
Priority date: 2011-04-04
Filing date: 2011-04-04
Publication date: 2014-02-05
Also published as: WO2012138319A1; EP2695057A4; US20170185468A1; US20140025998A1; EP2695057A1; US9612892B2

Abstract

Plural clusters or occurrences of a pattern of event types are identified (304). Based on configuration items relating to events associated with the event types, a correlation rule is created (308) to define a relationship between the event types.

Description

Create the dependency rule of relation between definition event type

Technical field

The infotech of enterprise (IT) infrastructure (for example, company, Education Organization, government organs etc.) can comprise relatively large arrangement of components.The IT keeper of enterprise can be assigned the task of managing I T infrastructure together together with other task, comprise the basic reason of the problem that identification detects.Yet it may be complicated managing relatively large IT infrastructure.

Accompanying drawing explanation

About the following drawings, described some embodiment:

Fig. 1 illustrates the example dependency rule that use case correlator creates that passes through according to some embodiments;

Fig. 2 illustrates the sequential chart along with the generation of time according to the event that can process by use case correlator of some embodiments;

Fig. 3 and 4 is according to the process flow diagram of the processing of being carried out by event correlator of some embodiments; And

Fig. 5 is the block diagram being incorporated to according to the example system of the event correlator of some embodiments.

Embodiment

Infotech (IT) infrastructure comprises arrangement of components, the all nextport hardware component NextPorts in this way of described assembly (for example, computing machine, storage server, communicator etc.), component software (for example, application, operating system, driver etc.), database component (for example, related data base management system, unstructured data storehouse system etc.) and/or other assembly., can there is variety of event in the part as the integrated operation of IT infrastructure, described event comprises the event relevant with a difficult problem, fault, problem, or the activity relevant with assembly in IT infrastructure.

Routinely, when being presented the event relevant with a difficult problem, fault, problem or activity, IT keeper is assigned with identification or determines the task of the basic reason of this type of event.Yet for relatively large IT infrastructure, the basic reason of event artificial determines it may is to expend time in and error-prone.

According to some embodiments, provide for automatically creating mechanism or the technology of the dependency rule of the relation between the event that is defined in two or more type separately.By using dependency rule, system can automatically be identified in the correlativity between event type, make system can for given event determine other one or more what caused this given event.By this way, the basic reason of the event relevant with problem, fault, problem or activity can effectively and accurately be identified.

Dependency rule can be specified the reason event of a type as the reason of the sign event of a type.More generally, dependency rule can be specified the reason event as one or more types of the reason of the sign event of one or more types.Reason event refers to the event that causes another event.Sign event is the event being produced by the generation of another event." event " can refer to a difficult problem, fault, problem, activity, operation, input, output or any other generation in IT infrastructure.Event can be classified as dissimilar.For example, one of event type is that database is out of order.The another kind of type of event is that mail service starts.The another kind of type again of event is that application server is shown mistake.There are many other examples of event type.

The example of dependency rule 100 is described in Fig. 1.For example, dependency rule 100 can be presented in display device with graphic form.Dependency rule 100 comprises that its example in Fig. 1 of reason event type 102(is that storer uses rank-approach capacity), described reason event type 102 is that its example in Fig. 1 of sign event type 104(is caching performance-low) reason.In Fig. 1 example, reason event type 102 is associated with allocation of computer project (CI), and sign event type 104 is associated with sql server configuration project.The configuration of configuration project definitions component, such as any other assembly of nextport hardware component NextPort, component software, database component or IT infrastructure." configuration " can comprise the attribute being associated with assembly.Usually, configuration project represents the discrete unit of the configuration relevant with assembly.Configuration project can be relevant with another configuration project (or a plurality of other configuration project).

Fig. 1 also shows the diagrammatic representation 106 of computing machine CI 108, and described computing machine CI 108 is by being related to that 110 are linked to sql server CI 112.In the example of Fig. 1, be related to that 110 is container links, in other words its instruct computer CI 108 comprises sql server 112(, sql server is comprised in computing machine).The dependency rule 100 of Fig. 1 provides the correlativity between

event type

102 and 104, event type 102,104 is associated with configuration project 108,112 separately, and has identified the relation between configuration project 108,112 separately.Configuration project (and more specifically, the relevance of the event type configuration project category such as computing machine CI classification 108 and sql server classification 112) and separately provides topological constraints, for be considered relevant corresponding event type according to dependency rule, must meet described topological constraints.

Although the specific example of the form of dependency rule is shown in Figure 1, note, in other embodiments, can use other form of dependency rule.

Information based on dependency rule 100, the special event occurring on (representing as the computing machine CI in Fig. 1) computing machine (using ranks-approach capacity such as 102 storeies that represent in Fig. 1) is likely the reason of the sign event that occurs together with (as the sql server CI 112 in Fig. 1 represents) sql server (for example, 104 caching performances that represent in Fig. 1-low).

According to some embodiments, in order automatically to create dependency rule, can analyze event stream.For example, Fig. 2 illustrates the timeline of event along with the time.In the example of Fig. 2, the transverse axis of four time intervals (t0, t1, t2 and t3) along timeline is identified.In IT infrastructure, event can be grouped into the time interval separately.For example, as shown in FIG. 2, triangle symbol represents the event separately having occurred along with the time.In time interval t0, two events have been there are; In time interval t1, three events have been there are; In time interval t2, five events have been there are; And in time interval t3, three events have been there are.As represented by legend 210,212 and 214, triangle symbol has for representing the different fill pattern of dissimilar event.The event of the first type (210) is the database event type that is out of order, and the event of the second type (212) is that mail server starts event type, and the event of the third type (214) is application server error event type.

For the object of example provides the quantity of illustrated event and the type of event in Fig. 2.In relatively large IT infrastructure, can there is the quantity of much bigger event and the quantity of event type.

Although Fig. 2 has described event to be divided in the time interval, in other embodiments, event can be divided in the division of other type that is different from the time interval.Other division can comprise the division that division that event occurs in different machines or machine group, event occur in the different part of enterprise or department, division that event occurs in different geographic areas etc.

As shown in Figure 2, there is event type pattern, that is, comprise database be out of order event type and pattern application server error event type in time toward each other closely (for example,, within the identical time interval) occur.Each event is associated with event type information, to allow mechanism to determine the type of each event having occurred according to some embodiments.In addition, event also can be associated with the configuration item object information of indicating timestamp that when event occurs and identification to be associated.

As described in Fig. 2,

real oval

202A, 202B, 202C and 202D have represented the generation separately of special event type that may be relevant each other (database in the example of Fig. 2 be out of order event type and application server error event type) pattern.Each generation of this event type pattern is the one group of potential relevant event type occurring within the time interval separately substantially.

Notice to be, Fig. 2 also shows the event that the mail server being present in time interval t1, t2 and t3 starts event type.In the example of Fig. 2, mail server starts event and has been confirmed as that with shown in figure 2 other event type is not relevant, and is not therefore identified as a part for the group of relevant event type.For example, because a variety of causes, mail server starts event type can be identified as noise.Event correlator can determine that mail server starts event type and occurs so frequently (with certain the predefine number percent more than the time interval, occurring), makes mail server start event type and is considered to noise and therefore should be not relevant to other event type.Event correlator therefore detection noise event type (than certain predefine threshold value event type more continually) and the relation of other event type is ordinary, and so should not be considered to be correlated with.Alternatively or additionally, event correlator can determine formerly generation that mail server starts event type not to database be out of order event type or application server error event type relevant because the darker analysis of the information being associated with these event types has been indicated to the relation not existing between mail server startup event type and other event type.

Although only show a kind of pattern of (being represented by group 202A-202D) event type in Fig. 2.But note, in other example, can have the various modes of event type.

Fig. 3 is according to for creating the process flow diagram of process of some embodiments of dependency rule.The process of Fig. 3 can be carried out by event correlator, is further discussed below.The reception event (at 302 places) along with past time, all events of describing in the timeline of Fig. 2 in this way of described event.The event receiving can be the archives of event or a part for other collection.

Event correlator is identified the repeatedly generation (group) (at 304 places) of event type pattern in received event according to some embodiments.Event correlator can call group technology being likely the set grouping of relevant event, because they occur together continually or are occurring in special time frame.The kinds of properties of event can be used for event to be divided into a plurality of groups of event type (for example, as shown in Figure 2 the group 202A-202D in a plurality of time intervals).

Then, event correlator is analyzed (at 306 places) and the information that configuration project is associated, and described configuration project is relevant with the event of this event type pattern.Then, in response to determining the dependency rule that creates relation between (at 308 places) definition event type in the analysis of the relation between correspondence configuration project.

Fig. 4 illustrates the further details of the analysis of carrying out at 306 places.In Fig. 4, what event correlator was determined (at 402 places) event type pattern repeatedly meets predefine standard, and described event type pattern comprises the be out of order pattern of event type and application server error event type of database in the example of Fig. 2.The single of special event type pattern occurs or relatively little generation quantity unlikely represents to exist the relation between event type.Yet if the quantity repeatedly occurring of event type pattern or the generation rate of event type pattern have surpassed predetermined threshold value, that can be the event type relevant indication each other of this pattern.In such example, " predefine standard " comprises the generation quantity of this pattern that surpasses predefine threshold value or the generation rate of this pattern.In other example, " predefine standard " can be another kind of standard.

The dependency rule creation task (308) of execution graph 3 in response to the event correlator that repeatedly meets predefine standard of deterministic model.If the repeatedly generation of pattern does not meet predefine standard, event correlator is by the dependency rule creation task (308) of execution graph 3 not.

For each group of event type, this of event correlator identification (at 404 places) and event type organized the set (for example, to) of relevant particular event.Noting, is that particular event is associated with configuration project, makes the identification of the set of particular event allow to access the configuration item object information that (at 406 places) are associated.In the example of Fig. 2 that relates to " database is out of order " event and " application server mistake " event, each " database is out of order " event can be associated with the example of database CI, and each " application server mistake " event can be associated with the example of application server CI.

Next, event correlator determine (at 408 places) particular event associated to configuration project whether be actual relevant.For example, can be for the configuration project implementation Shortest Path Searching of the particular event (particular event) each event centering.If there is not the path between the configuration project being associated in predetermined quantity (zero's or larger) jumping, Shortest Path Searching Algorithm is cancelled the right qualification of event separately.In other example, can use other technology that whether has relation for determining between configuration project.

The information repository that more generally, can be described in the relation between configuration project based on access determines whether (checking) relation between configuration project exists.For example, information repository can be the topological database that is identified in the central topological relation of configuration project.Topological database can be the form of chart, and described chart has corresponding to configuration item destination node separately and the link that is defined in the relation between configuration project.The node of topology chart can be directly link, or by other node indirect link.Two nodes that are directly linked to each other mean that configuration project separately arrives each other by a Path Connection of jumping.Configuration project is jumped and is linked to self by zero degree.If first node is connected to Section Point by the 3rd node, the configuration project separately being associated with the first and second nodes is considered to arrive each other by having the Path Connection of a jumping.More generally, if there is n-1 node between corresponding to a pair of configuration item destination node, this is jumped (n >=1) to configuration project by n and is connected to each other.

In other embodiments, information repository can comprise semantic database, and described semantic database comprises the information that is defined in the relation between configuration project.

Time interval t2 in Fig. 2 illustrates another special problem of the part solution that can be used as analysis (306).If the Multi-instance of the event type pattern of analyzing occurs in short time interval (such as in t2), which in the unclear event being associated is relevant.The candidate that such problem can be used for all possible composition of matter by establishment is to solving, wherein, if configuration project is not separately relevant, those candidate's Disqualifies.In the example of Fig. 2, right imaginary ellipse shape 204A and the 204B of " database is out of order " and " application server mistake " event is cancelled qualification, because the configuration project being associated is not relevant.

In the example of Fig. 2, four pairs of particular events (every pair comprise database be out of order event and application server error event) have been identified.Every pair and the special example of database CI and application server CI in event, and the path-dependent between two CI examples.

Next, different CI examples is abstracted into (at 410 places) CI classification rank to (and their path relation).Each example in configuration project has classification character, described classification property definition configuration item object classification.The dependency rule creating according to some embodiment operation techniques makes configuration item object classification relevant, but not makes configuration item object particular instance relevant.

As an abstract part, also determine the topology of the relation between the configuration project being associated with relevant event type.For example, relevant event type can be associated with the configuration project with relation of inclusion (a configuration project comprises another), or alternatively, determines, a configuration project is relevant with another configuration project by medium object.Determining like this can allow created dependency rule to specify in the topological relation between configuration project category.The form of the dependency rule completing such as the chart 106 with shown in Fig. 1 comprises the information of the relevant event type of identification and the information that relevant configuration project category (with together with their topological relation) is described.Allow topological constraints to be included in dependency rule the comprising of information that relates to relevant configuration item order classification.This topological constraints of dependency rule can be by checking that when determining that whether event type is relevant configuration item types and the relation configuring between item types verify.

According to the technology of some embodiments or mechanism, also can solve about losing the user's concern to the control of system.In order to win IT personnel's acceptance, rule can be generated and is embedded in regular creation instrument.Proposed dependency rule can be presented to user, described user can select to accept dependency rule, the dependency rule that proposes of refusal or revise and/or explain the dependency rule proposing according to present appearance, but not can't help the in the situation that user checking, automatically to inject dependency rule.

Fig. 5 is the block diagram comprising according to the example system 500 of the event correlator 502 of some embodiments, wherein, event correlator 502 is configured to information based on catching in event archives 506 and at database 512(for example, Configuration Management Database (CMDB) or CMDB) in CI information 514 automatically create dependency rule 504.Event archives 506 are included in event 508 on life-span (or certain predefined time interval) of IT infrastructure.The configuration project that CMDB 512 comprises the assembly separately that represents IT infrastructure.

The event 508 being included in event archives 506 can comprise various types of information, such as: problem describe or be associated with each event other describe, the information relevant with user, timestamp, kinds of properties and about the information of associated CI.The kinds of properties being associated with the information that relates to event provides the information about event type.

The event archives 506, database 512 and any dependency rule 504 that by event correlator 502, are created are stored in storage medium 510, described storage medium 510 can be realized with one or more memory storages, the memory storage of all memory storages based on disk in this way of described one or more memory storages, integrated circuit memory storage and/or other type.

System 500 also comprises one or more processors 516, and event correlator 502 is executable on one or more processors 516.In addition, system 500 comprises that network interface 518 communicates by letter with remote system by data network with permission system 500, and all events that produces in this way of described remote system are to be stored in the system in event archives 506.

Although event archives 506 and CMDB 512 are stored in the storage medium of system 500, note, in the example of replacing, event archives 506 and/or CMDB 512 can be stored in remote storage subsystem (or a plurality of remote storage subsystem).

By can automatically creating dependency rule 504, can reduce the professional knowledge that IT keeper or other user expect for the object of the basic reason of identification event.By can automatically creating the dependency rule 504 of the reason that can help automatically to determine sign event, can complete the improvement of efficiency and the reduction of cost in managing I T infrastructure.

The machine readable instructions of event correlator 502 is loaded for carrying out on one or more processors 516.Processor can comprise microprocessor, microcontroller, processor module or subsystem, programmable integrated circuit, programmable gate array or another control or calculation element.

Data and instruction are stored in memory storage separately, and described memory storage is implemented as one or more computer-readables or machinable medium.Storage medium comprises multi-form storer, and it comprises the semiconductor memory system such as dynamic or static random-access memory (DRAM or SRAM), erasable and programmable ROM (read-only memory) (EPROM), electric erasable and programmable ROM (read-only memory) (EEPROM) and flash memories; Disk such as fixed disk, floppy disk and removable disk; Other magnetic medium that comprises tape; Light medium such as CD (CD) or digital video disk (DVD); Or the memory storage of other type.What note is, can in a computer-readable or machine-readable storage media, provide instruction discussed above, or provide instruction discussed above on a plurality of computer-readables that alternatively, can be in being distributed in the large scale system probably with a plurality of nodes or machinable medium.This computer-readable or machine-readable storage media or medium are considered to the part of article (or article of manufacturing).The article of article or manufacture can refer to single component or a plurality of assembly of any manufacture.Storage medium or medium can be arranged in the machine of operation machine readable instructions, or are positioned at remote site place, can from described remote site, download machine readable instructions for execution by network.

In description above, state that many details are to provide the understanding to theme disclosed herein.Yet, can be in the situation that do not have some or all in these details to put into practice embodiment.Other embodiment can comprise the modifications and variations from details discussed above.Be intended that, claims cover this modifications and variations.

Claims

1. a method, comprising:

By the system with processor, receive (302) a plurality of events;

The plural number of being identified (304) event type pattern by described system in received event occurs;

By described systematic analysis (306) configuration item object information, this configuration project is relevant with the event that is associated with described event type pattern; And

In response to the analysis of determining the relation between corresponding configuration project, by described system creation (308), be defined in the dependency rule of the relation between described event type.

2. method claimed in claim 1, further comprises:

Whether the described plural number time generation of determining described event type pattern meets predefine standard,

Wherein, in response to occurring, carries out the described plural number that meets the described pattern of described predefine standard described establishment.

3. method claimed in claim 2, wherein, the described plural number that meets the described pattern of described predefine standard comprises that quantity that the described plural number of described pattern occurs or speed are over predefine threshold value.

4. method claimed in claim 1, wherein, identifies inferior a plurality of groups of comprising the described event type of identification of described plural number of described event type pattern.

5. method claimed in claim 4, wherein, identifies and in described a plurality of groups of time intervals that are included in separately of described event type, identifies described a plurality of groups of described event type.

6. method claimed in claim 1, further comprises:

For each generation of described event type pattern, the correspondence set of identification particular event separately; And

Described in the relevant configuration item object of the described particular event of access in gathering with described in each, information is to carry out described analysis.

7. method claimed in claim 6, wherein, the information described in described configuration item object of analyzing comprises: for the configuration project being associated with set described in each of particular event, determine between described configuration project and whether have path, and wherein, if described path exists, there is relation in described analysis indication between described corresponding configuration project.

8. method claimed in claim 7, wherein, if described path does not exist, there is not relation in described analysis indication between described corresponding configuration project.

9. method claimed in claim 7, wherein, determines and determines between described configuration project whether have the path in predefine jumping figure whether existing described path to comprise between described configuration project.

10. article that comprise at least one machine-readable storage media of storing instruction, described instruction makes the system with processor carry out according to the method for any one in claim 1-9 when carrying out.

11. 1 kinds of systems, comprising:

Storage medium (510), is used for storing the collection of event in infrastructure; And

At least one processor (516), is used for:

Identify at least relevant with the subset of described event special event type pattern a plurality of groups;

The configuration project of the particular event in the described event that access is associated with each group in described a plurality of groups; And

Configuration project based on accessed determines between described event type, whether there is relation; And

According to described definite establishment dependency rule to be defined in the relation between described event type.

System described in 12. claims 11, wherein, described at least one processor is configured to access topology or semantic database exists described relation with checking between described event type.

, wherein, if there is the path in predefined number of rings between accessed configuration project, there is described relation in the system described in 13. claims 12.

System described in 14. claims 11, wherein, described at least one processor will be further:

The configuration item object classification that identification is accessed,

Wherein, described dependency rule makes described in accessed configuration item object classification relevant and make described event type relevant, and wherein, and classification provides the topological constraints that are verified described in the configuration item object of accessing, to determine that whether event type is relevant.

System described in 15. claims 11, wherein, described at least one processor will determine that noise event type is not relevant to other event type.